woo-vipps / payment / VippsCallbackSessionHandler.class.php

VippsCallbackSessionHandler.class.php in Pay with Vipps and MobilePay for WooCommerce trunk, at payment/VippsCallbackSessionHandler.class.php

132 lines 5.3 KB

Raw Download Zip

1	<?php
2	/*
3	This class implements a Woocommerce Session Handler that works with callbacks from Vipps to the store
4	so that the customers session will be in effect when calculating shipping, calculating VAT and so forth. IOK 2019-10-22
5
6
7	This file is part of the plugin Pay with Vipps and MobilePay for WooCommerce
8	Copyright (c) 2019 WP-Hosting AS
9
10	MIT License
11
12	Copyright (c) 2019 WP-Hosting AS
13
14	Permission is hereby granted, free of charge, to any person obtaining a copy
15	of this software and associated documentation files (the "Software"), to deal
16	in the Software without restriction, including without limitation the rights
17	to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
18	copies of the Software, and to permit persons to whom the Software is
19	furnished to do so, subject to the following conditions:
20
21	The above copyright notice and this permission notice shall be included in all
22	copies or substantial portions of the Software.
23
24	THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
25	IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
26	FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
27	AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
28	LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
29	OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
30	SOFTWARE.
31
32	*/
33
34	class VippsCallbackSessionHandler extends WC_Session_Handler {
35	protected $callbackorder = 0;
36	protected $sessiondata=null;
37
38	public function init() {
39	global $Vipps;
40	$this->callbackorder = $Vipps->callbackorder;
41	return parent::init();
42	}
43
44	// Unfortunately, we need to override all of this, because
45	// the is_session_cookie_valid() method is private. On the
46	// parent class, this checks whether or not the user is logged-in,
47	// and if so, if this session is for the same user. But these callbacks
48	// should not have any user privileges, so they are not logged in. Therefore we only
49	// check the expiry of the cookie. IOK 2022-03-14
50	public function init_session_cookie() {
51	$cookie = $this->get_session_cookie();
52
53	if ( $cookie ) {
54	// Customer ID will be an MD5 hash id this is a guest session.
55	$this->_customer_id = $cookie[0];
56	$this->_session_expiration = $cookie[1];
57	$this->_session_expiring = $cookie[2];
58	$this->_has_cookie = true;
59	$this->_data = $this->get_session_data();
60
61	if ( ! $this->is_session_cookie_valid_ignoring_loggedinness() ) {
62	$this->destroy_session();
63	$this->set_session_expiration();
64	}
65
66	// We also won't do the logged-in update check, because we aren't logged in.
67
68	// Update session if its close to expiring.
69	if ( time() > $this->_session_expiring ) {
70	$this->set_session_expiration();
71	$this->update_session_timestamp( $this->_customer_id, $this->_session_expiration );
72	}
73	} else {
74	$this->set_session_expiration();
75	$this->_customer_id = $this->generate_customer_id();
76	$this->_data = $this->get_session_data();
77	}
78	}
79
80	// We can't override is_session_cookie_valid, which checks whether or not we are logged in.
81	// Therefore, call this instead in init_session_cookie. IOK 2022-03-14
82	private function is_session_cookie_valid_ignoring_loggedinness() {
83	// If session is expired, session cookie is invalid.
84	if ( time() > $this->_session_expiration ) {
85	return false;
86	}
87	return true;
88	}
89
90
91
92	public function get_session_cookie() {
93	if (!$this->callbackorder) return false;
94	$order = wc_get_order($this->callbackorder);
95	if (empty($order) && is_wp_error($order)) {
96	return false;
97	}
98	$sessionjson = $order->get_meta('_vipps_sessiondata');
99	if (empty($sessionjson)) return false;
100	$sessiondata = @json_decode($sessionjson,true);
101	if (empty($sessiondata)) return false;
102	list($customer_id, $session_expiration, $session_expiring, $cookie_hash) = $sessiondata;
103	if (empty($customer_id)) return false;
104	$this->sessiondata = $sessiondata;
105	// If passed as an actual cookie, we would verify the cookie_hash here, but since this is
106	// stored in the order object to which the user has no access, we don't.
107	// (Change triggered by change of logic here for Woo.) IOK 2025-08-26
108	return array($customer_id, $session_expiration, $session_expiring, $cookie_hash);
109	}
110
111	public function has_session () {
112	return !empty($this->sessiondata);
113	}
114
115	public function forget_session() {
116	if (!$this->has_session()) return;
117	$order = wc_get_order($this->callbackorder);
118	if (empty($order) && is_wp_error($order)) return false;
119	$order->delete_meta_data('_vipps_sessiondata');
120	wc_empty_cart();
121	$this->_data = array();
122	$this->_dirty = false;
123	$this->_customer_id = $this->generate_customer_id();
124	}
125
126	// This is only used for callbacks, so never set cookies.
127	public function set_customer_session_cookie( $set ) {
128	return;
129	}
130
131	}
132